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We study the advantages to be gained in quantum key distribution (QKD) protocols 
by combining the techniques of local randomization, or noisy preprocessing, and struc- 
tured (nonrandom) block codes. Extending the results of [Smith, Renes, and Smolin, 
quant-ph/0607018 pertaining to BB84, we improve the best- known lower bound on the 
error rate for the 6-state protocol from 14.11% for local randomization alone to at least 
14.59%. Additionally, we also study the effects of iterating the combined preprocess- 
ing scheme and find further improvements to the BB84 protocol already at small block 
lengths. 
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1 Introduction 

Using a quantum channel to create a secret key between two parties is closely related to using 
the channel to send quantum information, with many results found in one area applicable in 
the other. For instance, by treating the steps in a quantum key distribution (QKD) protocol 
coherently and viewing the entire process as an entanglement distillation scheme, one can use 
properties of random quantum error-correcting codes to prove the security of the BB84 1 
and 6-state [5] protocols up to bit error rates of p max — 11.0028% [3] and p max = 12.6193% 
[4], respectively. Conversely, the formula for the quantum channel capacity can be obtained 
by importing the key rate resulting from a general approach to secret key generation over a 
known channel [3 O [7] • 

One of the surprising results related to quantum capacity is the non-optimality of random 
codes, in contrast to the classical case. The classical capacity of a channel can be achieved by 
using randomly-constructed block codes, and the independence of one input to the channel 
from the next results in a so-called single-letter formula for the capacity. Random coding can 
be used to create quantum error-correcting codes as well, but these do not always achieve the 
capacity. Better performance can be achieved by structured codes which exploit the ability 
of quantum error-correcting codes to correct errors without precisely identifying them, a 
property called degeneracy. Initial results on rates achievable with degenerate codes displayed 
only modest gains [5J [3] , but recent analysis shows that degeneracy is crucial to the behavior 
of optimal codes [TU] . 

By appealing to the coherent formulation of the protocol, degenerate codes should also 
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be useful in QKD. This was shown to be the case in the original security proof of the 6- 
state protocol [4j, as the results of [9] were used to improve the error rate threshold to 
Pmax — 12.6904%. More striking threshold improvements are possible, if counterintuitive, 
by simply adding noise to the raw key bits before they are processed into the final key, a 
procedure known as local randomization [Til H2] ■ This improves the error rate thresholds for 
the two protocols to p ma x = 12.4120% and p m ax — 14.1119%, respectively. At first glance, 
these results make no sense in the coherent picture of QKD, since adding more noise to 
already noisy entangled pairs only decreases the amount of pure entanglement which can be 
extracted. The entanglement/secret-key analogy does not hold perfectly, however; entangled 
states are sufficient, but not necessary, for creation of secret keys. A broader class of states, 
called private states, lead to secret keys when measured [T3], and these should properly be the 
target output of the coherent version of the QKD protocol. Indeed, the exact error thresholds 
are recovered in the coherent picture when the QKD protocols with local randomization are 
analyzed in these terms |14) . 

With a systematic understanding of how degenerate codes and local randomization boost 
the key rate, it becomes sensible to combine the two methods to look for even higher thresh- 
olds. Recently it was shown in [15] that doing so improves the error threshold of the BB84 
protocol up to at least p max w 12.92% by using the same type of structured code studied 
in [8l[9l[T0]. These specific codes consist of the concatenation of two codes, the first a sim- 
ple repetition code and the second a random code. The repetition code, sometimes called a 
cat code in the context of quantum information theory since the codewords are |0)® m and 
|l)® m , induces degeneracy in the overall code since a phase flip on any of the physical qubits 
leads to the same logical error, and is corrected in the same way. In particular, blocklength 
m — 400 corresponds to the threshold stated above. Since the random code portion of the 
protocol corresponds to information reconciliation and privacy amplification in the classical 
view, the local randomization and the repetition code together become a type of preprocess- 
ing performed before these "usual" steps. In this paper we show that the same preprocessing 
protocol as used in [15] can also be used to improve the maximum tolerable bit error rate 
for the 6-state protocol, up to at least p ma x = 14.5930% for a blocksize of m = 300. This is 
already quite close to the upper bound of 14.6447% [16l [TTJ [T7J on the tolerable error rate 
for the BB84 protocol, and since the error threshold grows with blocklength, the bound is 
presumably exceeded at larger blocklengths, indicating the higher robustness of the 6-state 
protocol. In addition we investigate iterating the preprocessing scheme in the BB84 protocol, 
and show an improvement both in rate and error threshold over single-round preprocessing 
for even modest blocklengths. Our calculations are facilitated by a closer look at the repre- 
sentation theory relevant to describing the quantum states resulting from the preprocessing, 
enabling us to continue the investigation started in [15] to the 6-state protocol and iterated 
versions of the preprocessing for BB84. 

To begin, section II describes the preprocessing scheme in more depth and then derives 
secret key rate expressions for the BB84 and the 6-state protocols. Numerical calculations for 
blocklengths into the hundreds are then presented for the two protocols. Section III examines 
the advantages of iterating the preprocessing protocol to achieve higher rates and thresholds 
for the same amount of effort in noise addition and block coding. The appendix explains how 
representation theory is helpful for the numerical evaluation of such key rates in both cases. 
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2 Secure key rates using the preprocessing protocol 

The preprocessing protocol proposed in [15j begins after Bob has received the quantum sig- 
nals from Alice and they have sifted their raw keys to throw out mismatches between the 
preparation and measurement basis. Alice then flips each of her sifted key bits (xi, . . . , x n ) 
with probability q, resulting in new bits {x\, ...,x n ). These are partitioned into blocks of 
size m, and for each block she computes the syndrome (x\ © X2, xi ® X3, . . . ,Xi ® x m ) and 
sends this information to Bob. He computes the relative syndrome of their blocks by adding 
his corresponding syndrome to Alice's, modulo two. Alice's message is public knowledge, but 
the first bit of each block is still secret, so it is kept as a potential key bit. The protocol then 
proceeds with the usual error correction and privacy amplification steps to transform these 
kept bits into a secret key, now aided by the relative syndrome of each block and knowledge 
of the probability q of local randomization. Without local randomization, it turns out that 
to = 5 is the optimal blocklength for improving the error threshold in the 6-state protocol — 
longer blocklengths have worse thresholds [4]. However, the results in 15J indicate that with 
the addition of noise, the highest tolerable bit error rate of BB84 grows with the blocksize to, 
and we find a similar result in the 6-state case (see figure [T]). 

We determine the secure key rates of the BB84 and 6-state one-way key distillation proto- 
cols involving the preprocessing protocol described above using the security proof of Renner 
[18] . This proof states that the key rate of such a protocol is given by 

r= - min (S(X\E) - S(X\Y)) (1) 

TO <J AB tl 

where the minimum ranges over the set of states T of all density operators on the 2x2 dimen- 
sional Hilbert space Ha ®'H-b such that the measurement performed during the parameter 
estimation phase of the protocol leads to a certain bit error rate p. The conditional von 
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Neumann entropies in ([T]) are calculated for the states 

a XYE = ^-xye^a^b^e^^abe) (2) 

which describe the processing of each block, including local randomization and syndrome 
calculation, and eventual measurement of the output qubits of the repetition code. That is, 
the preprocessing is treated quantum-mechanically or coherently, but the usual processing 
classically. Here X denotes Alice's key outcome when measuring the output bits and Y Bob's 
key and syndrome outcomes. 

For the BB84 protocol the set T contains the states 

<tab = Y,P™Xb Z b\* + ){* + \ZbXb, (3) 

u,v 

where |$+) AB = -j= \ kk ) ab and {Puv} = {pao,Pio,Pn,Poi} = {1 - 2p + t,p - t,t,p - t}, 
t e [0,p]. In the 6-state protocol, meanwhile, parameter estimation assures us that T contains 
only the single state gab with {p uv } = {1 — |p, |, |, |}. 

Using Renner's proof allows us to include the preprocessing but still only minimize over 
the quantum states a corresponding to individual signals. The crucial simplification is that 
the quantum state of the block can be taken to be the product o-® m without loss of generality. 
Other proof techniques would require minimization over all possible (potentially-entangled) 
block states, or an additional step in the parameter estimation procedure to ensure that the 
state does have this power form. 

2. 1 Computation of the secure key rate 

To compute the secure key rates we make use of the fact that the difference of entropies in (|TJ) 
can also be written as difference of corresponding quantum mutual informations, i. e. S(X\E) — 
S(X\Y) = I(X : Y) — I(X : E). In order to calculate these quantities, we need to determine 
the states & xye defined in (|2|) . Start with an m-fold tensor product of a purification of uab , 

u,v 

where u, v G {0, 1}' TI = F m so that X s = X Ul <g> X U2 ® • • • , and similarly for Z t7 and pa$. We 
now need to calculate the state resulting from noisy preprocessing followed by a blockwise 
stabilizer code measurement in which the stabilizers contain Pauli 1 and Z operators only. 

The first step, local randomization, can be described in a coherent way by adding a 
classical register A' (such systems will be denoted with boldface type) in the state ((1 — 
q)|0)(0| + g|l)(l|)® m and then applying controlled not gates from the individual register states 
to the bits A. This leads to 

W)abe - E V^^^I^I^I/lA'I^E/il^, (5) 

where / € F m and 1f= <r (1 — q) m ~f for / = |/|, the number of Is in /, a notation we shall 
use throughout. Here we have used the fact that Xa\$ + ) ab ~ Xb\$ + ) ab t° simplify the 
expression; this move is responsible for the Z* operation applied to E^. 
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In the second step, Alice and Bob both measure the m — 1 (generators of the) stabilizers 
of a 1/Z-only stabilizer code which encodes one logical qubit into m physical qubits. Using a 
public (authenticated) channel, Alice sends her syndrome to Bob who calculates the relative 
syndrome s by adding Alice's string to his measurement outcome modulo two. Afterwards 
both decode their encoded state. Such a stabilizer code together with an encoding U enc \e, c) = 
\0(e, c)), where 

\0(e, c)) = |c • rj m + J2T=i e J ' ( 6 ) 

can be fully specified by defining two bases {£i}i=i... m and {fjj}j = \... m both spanning F m 
with the property that • ffj = 5{j (see e.g. [H]). In this case the stabilizers are given by 
Z(£i) = Z™, i = 1 ... 771 — 1, and a measurement of these stabilizers on the encoded state © 
will give the syndrome e. Measurement of the logical Z operator Z(£ m ) gives the value of 
the encoded bit c. Applying one of the X(f)i) = X Vi , i = 1 . . . m — 1, operators on a encoded 
state results in a flip of the i-th bit of the syndrome, while applying the logical X operator 
X(rf m ) flips the encoded bit, ci— > c© 1. Both the set of all and the set of all X(ffj) are 

complete sets of commuting observables. Note that (i) 

- -™ E 4 E c )>aI*6 c)) B) (7) 

v e c 

and (ii) that any m fold Pauli operator can be decomposed as 

rn— 1 

x a z v = X ^ a (rf m )Z^(U) II X^{ffi)Z^^i), (8) 

»=i 

where £ m • it and ?7 m • v are the logical bit and phase flip errors resulting when this Pauli 
operator is applied to an encoded state like ([6]). In other words, the maximally- entangled 
state of m physical qubits is the equal superposition of a logical maximally-entangled state 
in all the possible encodings, which can be seen using the completeness of ffi. Meanwhile, the 
formulation of physical X and Z operators in terms of their logical versions follows from using 
the orthogonality of the ffi and £j. Using these two facts we find that, after Bob's calculation 
of the relative syndrome s, the tripartite state can be expressed as (up to a local unitary 
acting only on Eve's systems) 

W') A be = E v^^ m ' (S+/) ^ m '^ + >^i^A^> Bl 4j«) £ j^BM (9) 

where s = (£i • (it + /),... , £ m _i • (u + /)). While the registers A and B in equation (O have 
been m-qubit registers, here they contain only a single qubit each. Alice missing (m — 1)- 
qubits have been traced out since they contained only classical information about her absolute 
syndrome (accessible to all parties). The rest of Bob's m-qubit register now contains classical 
information about the relative syndrome s and is labeled B'. We now restrict ourselves to 
the cat code, which is given by = Sij + <5;+i.j for i = l...m— 1, (£m)j = Sij and 

(ffi)j — for i = 1 ... 777 — 1, (ffm)j = 1 ( see figure[5|). The name comes from the fact that 

a|0(5,O)) +/3|6»(0,1)) = a|00. ..0) +0\11.. .1), a Schrodinger cat state when a = @ = -j=. 
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Fig. 2. Cat code encoding one qubit into m = 4. The operators on the left hand side are the 
= Z^* (i = l...m from top to bottom), those on the right hand side the X(fji) = X 71 * . 
The (generators of the) stabilizers are within the dotted line, the (generators of the) normalizers 
within the dashed one. 



Finally, Alice and Bob both measure their key bit. Alice forgets about which bits she 
flipped by tracing out the A' register. The correlations between Alice, Bob, and Eve are 
described by the following semiclassical state: 

&XYE = J /2^ A ® ^2 /2 VPtifiPu,v 2 qf[x + im ■ (u + T)]b 

x s f v u v 2 

® ® [u] El ® (z^)% zijv^iz^ )% , (io) 

where [x]b = \%) (x\ B , etc. Note that the state is diagonal in E\ since the quantities • (u + f) 
are all classical: i — 1, . . . , m — 1 is already classical in (J9j> , i — m became classical after the 
key bit measurements by Alice and Bob. The {£i}i=i,...m span F m thereby completely fixing 
the string u + f. 

To calculate the quantum mutual information between Alice and Bob we trace out Eve 
and obtain 

GXY = 2 ® z2 Paq A x + ^ m ' (^+ ® Kl*i ' + /): ■ ■ • 

= g T^Na ® J^Pu + £m ' «]b ® [(£l • W) 6 • u, • • ■ 

where p = p(l — q) + (1 — is defined as pa = p u (l — p) m ~ u , and P(l x ,s) — {p s (l — 

p^m-s^i-l x (pm-*(i _ pyy* . In the last step we used u — l x fj m + J2i s iVi to write the sum 
over u as a sum over l x and s, where l x is the logical X error, i.e. A error on the first qubit 
in the block. This immediately yields 

I(X:Y) = l-^P(sOH 2 (P(l x \g)), (12) 

s 

using the binary entropy H^ix) = —a; log a; — (1 — x) log(l — a;). Note that I(X : Y) does not 
depend on the particular values {p uv } in gab (see ©), but only depends on the bit error 
rate p = pio +pn- The form of the mutual information indicates the advantage provided by 
the syndrome. If Alice did not send any information, Bob's state would be averaged over the 
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possible syndromes, and the mutual information would involve the entropy of the average of 
the P(l x \s) rather than the average of the entropies. By concavity of entropy, the latter rate 
is larger. 

To calculate the quantum mutual information between Alice and Eve, we trace out Bob's 
systems and obtain 

a XE = \ Yy^ A ® Pe}e 2 > ( 13 ) 

X 

Pe]e 2 = J2Pu [Ae x ® PeI U , and (14) 

U 

pg' a = (Z^f E <lfZ^\itl*\u\Z f {Z^T, (15) 



with 



\v\u) = J2vp^\v>- ( 16 ) 



We proceed with the computation of the secure key rate for the BB84 and the 6-state protocol 
separately in the following two subsections. 

2.1.1 BB84 

To calculate the secure key rate we must find the minimum over all <jab of the difference 
between the quantum mutual information between Alice and Bob and Alice and Eve. Since 
I(X : Y) does not depend on the particular structure of {p uv } = {1 — 2p + t,p — t, t,p — t}, 
t G [0,p], in (tab, but only depends on the bit error rate p = pio +Pu, this corresponds to 
finding the maximum of I(X : E). 

Let us assume for a moment that this maximum is achieved for independent bit and phase 
errors, i. e. we consider the state gab with {p uv } = {1 — 2p + t,p — t,t,p — t} and t = p 2 . In 
this case \^\s) does not depend on u, and we get 



with p pq = (1 - q)\ip+)(<p + \ + q\tp-){tp-\ and |<^±> = \/l - p\0) ± y/p\l). Part E x and E 2 
of the state p$ E in (fT4|) are now completely decoupled. As it was shown in [15J . the 
fact that Ex is classical allows the corresponding state describing dependent errors to be 
reconstructed from this state: After tracing out the E\ part, we add an ancilla [0]b 3 , apply 
the isometry J2s v ^/Ps\ff\'^) e 3 (^\ ® W\e 2 anc i eventually dephase the ancilla. Since quantum 
mutual information never increases under local operations, the maximum of I(X : E) is indeed 
achieved for independent errors and we get 

I(X : E) = S(±pf q m + l -{Zp pq Zr m ) - mS{ Ppq ). (18) 

Subtraction of (fT8"|) from p^|) gives the secure key rate for the BB84 protocol: 

m— 1 , s 

r (m, p) = max - [l - £ ( m ~ )P(s)H 2 (P(l x \sf 



s=0 



S(~PT + \{Z Pm Zr m ) + mH 2 + v/l-16p(l-p) g (l- 9 )))]. (19) 
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Fig. 3. Secure key rate r of BB84 for various types of preprocessing versus bit error rate p. No 
preprocessing corresponds to rgp, noisy preprocessing to r m= i, and the maximum over all block 
lengths m < 250 to r max , shown in red. For the rates achieved by the blocklengths m = 1 and 
m = 250, the corresponding rate of the added noise is shown on the right y axis. 



Omitting the maximization over q, the above formula gives the key rate r m ^ q (p) for some fixed 
values of to and q as a function of the bit error rate p. By setting r m , q (p) equal to zero, we 
find p ma x(fn, s)j the maximum tolerable bit error rate for given to and q. For very high levels 
of added noise, i. e. for q = ^ — e, we find that for all values of m, the key rate becomes zero 
at the bit error rate p ma a:(m, g = ^ — e) = 12.4120%, but by adding less noise at higher values 
of to, secret keys can be generated for even larger bit error rates. 

Without the use of the cat code (i. e. if we take to = 1) the rate reduces to [TT| [T2] 



r{p) = max 

9 



1 - H 2 (p) - H 2 (p) + J7 a (i(l + ^1-16^(1-^(1-9))) 



(20) 



With neither local randomization (q 
becomes even smaller [3], 



= 0) nor use of the cat code (to = 1) the key rate (f20|) 
r(p) = 1 - 2H 2 (p), (21) 



and secure key generation becomes impossible for bit error rates higher thaap max — 11.0028%. 

Figure [3] shows plots of the key rates given by ([2Tj) and ([20|) (black) and the maximum 
over the key rates given by (| 19|i (red) for values of to up to 250. The increase of the maximal 
tolerable bit error rate with the block length m is illustrated in figure Q] The highest value of 
to for which we maximized the tolerable bit error rate as function of the added noise q was 
to = 500 leading to p m ax(m = 500, q = 0.32656) = 12.9379%. 

By far the most difficult part in the numerical evaluation of (|19[) is computing the von 
Neumann entropy, as it contains a sum of two TO-fold tensor products of different one qubit 
density operators. Such an expression can be more efficiently calculated by taking into account 
its block diagonal structure which follows from permutation invariance, as detailed in the 
Appendix. 
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2.1.2 6-state 

Since the set T only contains the single state {p uv } = {1 — §p, §, §}, minimization over 
gab is unnecessary and the secure key rate is directly given by the difference of the quantum 
mutual informations between Alice and Bob (fT2|) and Alice and Eve. Despite the simplicity 
of r, this calculation is more difficult than BB84 due to the correlation between bit and phase 
errors. The corresponding conditional probabilities are given by p v= i\ u =$ = 2(i-p) = 
p v =o\u=o — 1 — p' an d P v \u=i = \- Therefore, denoting the number of ones in u as u and by 
reordering the qubits in such a way that the first u qubits are the ones with u, = 1 , we get 



® w+ 



= I* 



\u) 



(22) 



with |±) = ^(|0) ± |1)) and |^4) = V7|0) ± ^/T - leading to 



p (x),u = ( Z v m ^J2qfZ?[+]® u <g> [if' + ]^ m - u Z f "(Z^ 



(23) 



with a = (1 — q)[+] + q[—] and 7 = (1 — + q[^>-]. Reordering the state in this manner 

does not change the entropy and so will not alter the rate. Using these results the quantum 
mutual information between Alice and Eve can be expressed as 



I{X : E) = ( )P U ( 1 ~p) m ~ u S(^a® u <g> 7®™"" + X -{ZaZ)® u ® {Z^Z)®" 1 ' 11 ) 

u=0 



:(q) - (m - u)ff 2 (|(l + y/l- 16p'(l - p')q(l - 5)))] . (24) 



Since a and ZaZ are diagonal in the same basis we are able to write the von Neumann entropy 
as 



E 

fc=0 



u\ / (l-g)V k g, m _ M 
fc \ 2 7 



u—k 



{Z 1 Zf 



(25) 



which is of the same form as the von Neumann entropy in (|18[) . Therefore the same methods 
for evaluation can be applied; see the Appendix. 

The secure key rate is given by subtracting (|24|) from (fi"2"l) . 



r(m,p) — max — 
g m 



m— 1 



s=0 



m — 1 



P 



(s)H 2 (P(l x \s)) - I(X : E) 



(26) 



As it is the case for the BB84 protocol, the key rate becomes zero for all values of m for q — > | 
(this time at bit error rate p m ax(m,q = h — e ) = 14.1119%), but again adding less noise at 
higher values of m gives rise to secret keys for even higher bit error rates. 
Two special cases emerge from (1261) . m = 1: 



(p) = max 1 - H 2 (p) - ^Pu (H 2 (p v \ u ) - #2(3(1 + V 1 = 1 6pi|«(l ~ Pi|«)<?(l - <?)))) 



(27) 
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and q = 0, which leads to [3 OH]: 



r(p) = - l-^P(,s) J ff(P(P,P|s) 



(28) 



5 



(note the appearance of the usual entropy, not the binary entropy), with 



| r(m-2s)+s/j _ \(l-P)(m-2s)+s 



+ 



*o,i-(m-a.)+. {-if (1 - 2p)^ l ^ m -^+ s (29) 



which attains the highest robustness for m — 5 leading to p m ax{m = 5, q = 0) = 12.6904% 
instead of Pmaxi'm = l,q = 0) = 12.6193%. |? 

In figure|4]we show the key rates in these special cases as well as the general case for optimal 
noise and blocklengths up to m — 125. Included are q — 0,m — 1 (black), q = Q,m = 5 
(dotted), and m — 1 for the optimal q (black). The maximum over the key rates given by 
([26]) for values of m up to 125 is shown in red, along with the specific case of m = 125. The 
increase of the maximal tolerable bit error rate with the block length m is illustrated in figure 
[T] The highest value of m for which we maximized the tolerable bit error rate as function of 
the added noise q was m — 250 leading to p max (m = 250, q = 0.31210) = 14.5741%. Since 
the computation for larger blocksizes becomes rather slow, we extrapolated the value for the 
optimum noise leading to q as 0.31650 for m = 300. By calculating the highest tolerable 
bit error for this value of noise we get the best lower bound p m ax(jn = 300, q — 0.31650) = 



3 Iterated Preprocessing 

By combining local randomization with the cat-code of size m, Alice and Bob gain an advan- 
tage over Eve and intuitively it seems this advantage might be even bigger by performing the 
procedure twice. In this section we discuss such a twofold iterated protocol where Alice adds 
noise at a rate q to ni2 blocks of size mi each, and then after measuring the syndromes of 
these blocks, adds further noise at another rate Q to the ni2 'key' bits of these blocks. Then 
the syndrome of these mi bits is measured and the remainder of the protocol proceeds as 
usual. We restrict ourselves to the BB84 protocol for simplicity. Using essentially the same 
argument as in section al. 11 we find that we only need to consider independent bit and phase 
errors described by the state oab with {p uv } = {1 — 2p + t,p — t,t,p — t} and t — p 2 : (i) 
I(X : Y) depends only on the bit error rate p — pio +pn, (ii) therefore we have to find the 
maximum of I{X : E), (hi) which is achieved for independent errors. The proof of (iii) works 
as in section [2.1.11 since, as we will see, E\ of a X g is again classical. 



"Note that in [8] [9] the quantity under consideration was the capacity of the quantum depolarizing channel 
with {p uv } = {1 - p, |, §, |} therefore leading to p max = § X 12.6904% 



14.5930% 



Author(s) ... 11 





10° 




10" 




10" 




10" 




10" 








10" 




10" 




10" 




10" 



6-state 







<7m=l 






?m=125 


















/ 

; /V s 

"m=125 — —J \ 

/ \ 


\ 








\"max 


































TLo 




r m =i 







0.5 
0.4 
0.3 
0.2 
0.1 



0.12 0.125 0.13 0.135 0.14 0.145 

P 

Fig. 4. Secure key rate r of the 6-state protocol for various types of preprocessing versus bit error 
rate p. No preprocessing corresponds to rL , noisy preprocessing to r m — i, and the maximum 
achievable rate over all blocklcngths m < 125, to r max , shown in red. For the rates achieved 
by the blocklcngths m = 1 and m = 125, the corresponding rate of the added noise is shown on 
the right y-axis. The dotted rate with p m ax = 12.6904% is due to Lo, corresponding to use of a 
repetition code of blocklength m = 5 and no noisy preprocessing. 



3.1 Rate Calculation 

We start with ©, now denoting m as mi. Adding additional noise at rate Q to the key bit 
the state is described as 



)ABE - Y Y \JPu,v1fQFX 
f.u,v F 



B 



\u) Ei (Z^) F Zf\^ E2 \s) B \f) A ,\F) A ,, (30) 



with classical registers B, A' and A" and the same relationship s = (£i • (u + /),. .. , £ mi -i • 
(u + /)) as before. Now we consider the m2-fold tensor product \a) and define the 
abbreviations U = (£ mi • (ui + /i), . . . , £ mi ■ (u m2 + /m 2 )) and v = (in -vi,..., ff mi ■ v m . 2 ). 
Again Alice and Bob both measure their stabilizers, Alice sends her result to Bob, who 
calculates the relative syndrome S = (£i • (U + F), ■ ■ • , £m 2 -i ' (P + F)). Both then measure 
their key bit. The tripartite semiclassical state describing the correlations is now given by 



7 xye^\Y^f Y q fi--- q f m2 Y 

F fl,-,fm 2 «l,-,«m 2 

X ^[x]^ ® [x + L X ] B <8> [si, 



■Pa„ 



m 2 
i=l 

where = and 3 = (6 ' + £), • • •)» 5 = (£ ■ (U + F),...), and = 
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To calculate the quantum mutual information between Alice and Bob we trace out Eve's 
systems and obtain 

(Txy = \^2Qf ^2 Pfli • • ■Pn™.* ^ Ma &[% + L X ] B ® [si . ■ ■ s m2 , S] B , (32) 

p ui...u m2 & 

using p = p(l — q) + (1 — Since Alice's additional noise / is now combined with Eve's noise 
u, f no longer appears in the the syndromes si and S: Si = (£i -Ui, . . . ), S = (£i • (C/' + i 71 ), . . . ). 
Additionally, L x is now L x = £ m2 • ([/' + F), with [/' = (£ mi • u\, . . . , £ mi • u m2 ). The mutual 
information can therefore be written as 

I(X:Y) = 1- P'(si---s m2 ,S)H 2 ^P'(L x \s 1 ...s m2 ,S)y (33) 

s\...s 7n2 ,5 

where the probability distribution P' only depends on the number of ones in each of the 
syndromes Sj and S (we assume that the zeros and ones in S are ordered such that the 
syndromes s*i, i G {1, . . . , to 2 — S 1 }, correspond to Si = 0): 

roj- S 

P'(i :c = )Sl ... Sm2 ,5)= f[ [(l-p) mi ~ s ^(l-Q) + (l-p) s *P mi - s 'Q]x 

1=1 

n [(i-prp mi - s '(i-Q) + (i-pr i - s ^Q]. (34) 

i=m 2 -S+l 

In addition we see from (|34|) that for a given value of 5* only the frequency distribution of the 
Si, i G {1, . . . , 7Ti2 — S}, and the Sj, j € {7712 — S + 1, ... , 7712}, matters. This fact can be used 
to speed up the calculation of the sum over the syndromes in (133]) . 

Since p$' S = (Z® m ^ m *) x [{l - Q)pf™ 1 + Q(Z ' p vq Z)® mi \® m ' '■ [Z® m ^) x ', the mutual in- 
formation between Alice and Eve can be seen to be 

I(X : E) = s(~ [(1 - Q)p%^ +Q(Zp pq Z)* m *] ®" 12 + \ [Qp%» + (1 - Q) (Zp pq Zf^f m2 ) 

- m 2 S((l - Q)pX x + Q(Zp pq Z)® m >) (35) 

Once more the secure key rate is given by the difference of these mutual informations, 

r(mi,m 2 ,p) =max — (l(X ■ Y) - I(X : E)). (36) 

q,Q 771l77l2 

Again the hardest part in the numerical evaluation of (|36[) comes from the von Neumann 
entropies. One contains a sum of two 7712-fold tensor products of different density operators, 
but this time these density operators are mi-qubit density operators. Such an expression 
can also be calculated more efficiently by taking into account its permutation invariance. For 
more details see the Appendix. 

We compare the resulting key rate of the toi x 7112 = 3x3 iterated code with the key rates 
of the non-iterated codes of blocksizes to € {9, 10, 11} in figure OH 
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Fig. 5. Secure key rate r of BB84 with iterated preprocessing of size mi X rri2 =3x3 versus bit 
error rate p. The right y-axis shows the corresponding values of added noise in the first (q) and 
second iteration (Q) as well as values of the total amount of added noise (qtot = <?(1 — Q) + (1 — q)Q , 
red). For comparison, the rates of the non-iterated protocol are shown for blocksizes m S {9, 10, 11} 
(dashed lines). The corresponding values of added noise for these cases are also shown (dash-dot 
lines). 

4 Conclusions 

Although sending quantum information and establishing a secret key are not equivalent uses 
of a quantum channel, their similarities are enough to ensure a fruitful exchange of techniques 
between the two problems. Here we have extended the application of structured codes to the 
problem of QKD given in |15j to the 6-state protocol, showing how preprocessing based on 
both structured codes and local randomization leads to higher tolerable error rates. Having 
one more unbiased basis implies correlation between bit and phase errors of the estimated 
quantum state, leading to increased robustness of the protocol. Indeed, it seems likely that 
for large blocklength (m ~ 500) the threshold of the 6-state protocol exceeds the lowest 
known upper bound on the threshold for the BB84 protocol (14.6447%). This method of 
preprocessing does not close the gap between BB84 upper and lower bounds, however, as 
the available data suggests that the BB84 threshold never exceeds roughly 13% even for 
asymptotically-long blocks. For the 6-state protocol, more data is needed to draw even a 
partial conclusion on the asymptotic threshold. 

Additionally, we have shown that further performance gains are possible when iterating 
the preprocessing step. Although our results are confined to two rounds with small block 
sizes, we can nevertheless already observe some general properties. The entire rate curve 
shifts to higher values, so this type of processing might be useful in increasing the efficiency 
of protocols running over noisy channels. Intriguingly, the total amount of noise added to 
the sifted key bits is essentially the same as in the case of one round, showing that the 
improvement comes from making better use of the same amount of noise. More sophisticated 
representation-theoretic methods, in particular a Clebsch- Gordon decomposition of the states 
input to the second preprocessing round, should make analysis of more rounds and larger 
blocksizes tractable. 
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Fig. 6. The concatenated code of size m\ = 4 and m,2 = 3 encoding one qubit into n = mi X m,2- 
The operators on the left hand side are the Z(£i) = Z«, those on the right hand side the X(fji) = 
X Vi . The stabilizers are within the dotted line, the normalizers within the dashed one. 
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Appendix A 

Efficient computation of the key rates 

To evaluate the secure key rate of the BB84 and the 6-state quantum key distribution protocols 
involving our preprocessing protocol, we need to compute the von Neumann entropy of a linear 
combination of m-fold tensor products of different one-qubit density matrices, S{ap® m + 
(3cr® m ). In the case of the iterated preprocessing protocol this expression becomes a sum 
over m2-fold tensor products of some qudit density matrices of dimension d = 2 mi . In this 
appendix we discuss how such expressions can be evaluated efficiently by using the Schur 
transform, following the presentation in [20) . 

Considering m qudits of dimension d, the Schur transform is a unitary transformation re- 
lating the standard computational basis . . . i m }}, ij = 0, 1, . . . , d— 1, to a basis associated 
with the representation theory of the symmetric and general linear groups, 



The new basis {|A)|pa)|<7a)} is labeled by a Young diagram A denoting the irreducible repre- 
sentations of both S m and GL d , a Young tableau p\ labeling the basis vectors spanning the 
representation spaces of S m , and a Weyl tableau q\ labeling the the basis vectors spanning 
the representation spaces of GL^. Elements cr e GLd and s £ S m transform the basis states 
according to 



whereas o\ denotes <j® m in the irrep A and s\ denotes s in the irrep A. 

It then follows that states like p® m are block-diagonal, with blocks labeled by a Young 
diagram and tableau (\,p\). Blocks with the same Young diagram are identical, and the 




(A.l) 



a 



m \\)\px)\qx) = \X)\px) M<Za)), 
s\X)\p\)\q\) = |A> (sa|pa)) \qx), 



(A.2) 
(A.3) 
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number of Young tableaux Ny(X) specifies degeneracy. Meanwhile, the dimension of the 
blocks is given by the corresponding number of Weyl tableaux N\y(\). 

This structure is clearly helpful for the calculation of expressions like S(ap® m + (3a® m ). 
The entropy of the state reduces to the sum of entropies of the blocks, which itself factors 
into the entropy for a block (\,p\) with a fixed Young tableau p\, say the first one, times the 
corresponding degeneracy iVy(A). 

For d > 2 we explicitly calculate both the p\ and the a\ blocks using (jA.lj) . e. g. 



(PA) Q9 = (QA|(PA|(A|p^ m |A)b A >| (7A > 



jl.--.Jrr, 



[U 



Schiji 



Sch\ 



l---irrr 



0'i 



.,j m \p® m \h,...,i m ) 



The Schur transform itself can be obtained using e.g. the eigenfunction method [20]. For 
the iterated protocol it may be possible to further streamline the calculation by taking into 
account the fact that the qudit inputs to the second round are themselves block-diagonal. 
Computations for much larger blocksizes mi x m 2 may then become feasible. 

For d = 2 things are simpler, as Young diagrams A consist of at most two rows and can 
be labeled by an index j, where 2j is the number of columns consisting of one row only 
(j = . . . y if to is even, j = | • • • ^ if m is odd) . 

3 T-j 2j 

: 

A = 



The dimension of an irreducible representation with label j is Nw(J) — 2j + 1 and the Weyl 
tableaux are now labeled k — —j, . . . , j, whereas j + k denotes the number of ones in the first 
row of the Weyl tableaux: 

" -3 2j 




The corresponding degeneracy follows from Robinson's hook length formula, which in this 
case yields 

m \ 2j + 1 
v to/2 - 



Vv: /; 



(A.4) 



jj m/2 + 

We diagonalize p and a, denoting the two eigenvalues of p [a] as p\ and P2 [<J\ and 172] > 

p=U p gUl, Q = 6\zg{pi,p 2 }, 

a = U a qUl, <; = diag{ ai,a 2 }, 

and note that diagonal density operators like g and <; can easily be expressed in the j-th 
representation, since they are diagonal in all these representations, too. The action of g® m 
on basis states (|A.1[) of the Schur basis becomes simply a multiplication by powers of the two 
eigenvalues because of the symmetry properties of these basis states: Each basis state of the 
Schur basis labeled by a certain Young diagram j and Weyl tableaux k consists of a superpo- 
sition of computational basis states which are permutations of \Q\^®^ m / 2 ~^ |q^®(J-' c ) \^®(i+ k ) 
independently of the Young tableaux (specifying degeneracy). We obtain 

Qj 



^ g {p{- k p{ +k {p lP2 r^} k ^ 3 



(A.5) 
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and an analogous expression for To get the non-diagonal original block pj [<jj\ we have to 
apply the unitary U p [U a ] in the irrep j which is given by the Wigner rotation matrices Dj (U p ) 
[Dj{U<j)\. In our case these Wigner matrices are given simply by matrix exponentiation, 
Dj(U p ) = cxp(— ^j^(J + — </-)), where 9{p) denotes a phase calculated from p, and J± denotes 
the usual angular momentum ladder operators, J±\jm) = \fj(j + 1) + m(m ± T)\jm ±1). In 
this way it becomes feasible to calculate expressions like S{aa® m + (3p® m ) for values of m up 
to several hundreds. 



